As the ultimate guardians of trust in the digital business landscape, Qualified Trust Service Providers (QTSP) ensure the integrity and security of a wide range of transactions, building trust and confidence in the digital economy. A QTSP is authorised to provide any of the trust services defined in the eIDAS regulation - such as issue certificates, create signatures or seals - on the qualified level. The highest level of security and legal standards as defined by the EU eIDAS regulation.
How do organisations balance the many obvious benefits of conducting business in a digital environment against the risks? In other words, how do businesses minimise their own exposure and gain the confidence of their customers and partners while remaining compliant with all relevant regulations?
The answer, in short, is through engaging a Trust Services Provider (TSP), a trusted, third-party entity that ensures the security of online transactions and provides a way of validating them afterwards.
Trust services are defined in Article 3 (16) of the eIDAS regulation – the governing framework for trust services within the EU. Article 3 (16) defines several types of electronic services provided for remuneration, among those services are:
Trust services provide a way of securing and validating transactions conducted in a digital environment. Trust services protect businesses and enhance their operations by ensuring data security and privacy and by providing a clear audit trail that can be used as evidence in the event of a legal challenge.
For example, trust services allow businesses to:
The eIDAS regulation defines a class of trust services that provides the highest levels of security and legal recognition: Qualified Trust Services.
A Qualified Trust Service Provider (QTSP) is authorised to provide trust services on what is termed the “qualified” level. A QTSP may provide one or more of the trust services defined in Article 3 (16), for example providing qualified electronic signatures and qualified electronic stamps.
But QTSPs are much more than technical service providers. They serve as a critical pillar in the digital ecosystem, safeguarding trust, security and efficiency in online transactions.
To obtain the status of QTSP, a trust service provider is subjected to a rigorous conformity process. Once approved as a QTSP, the provider must pass regular audits by an approved conformity assessment body. QTSP are also supervised in the member states where they are established for their adherence to eIDAS regulation and the cybersecurity requirements of the NIS2.
Working with a QTSP fosters confidence on the part of your business, your customers and all stakeholders, creating a secure, reliable environment for conducting business and interacting digitally.
Using qualified trust services enables cross-border interoperability and recognition of signed documents and other electronic transactions across all EU member states. In other words, a transaction secured by a QTSP based in any member state will be considered as qualified in every member state.
Using the services of a QTSP:
The use of qualified trust services affords businesses a special legal protection under EU law. In the event of a legal dispute involving a transaction secured by a QTSP, the transaction is automatically recognised as a valid electronic signature. In other words, the burden of proof rests with the challenging party, not the party who has used a QTSP.
For example, an agreement signed with a qualified electronic signature (QES), which only a QTSP can provide, is automatically trusted and accepted throughout the EU with the same legal standing as a pen-and-ink, or “wet” signature.
By contrast, a document signed with an Advanced Electronic Signature (AES), a non-qualified trust service, does not enjoy the same legal status. The burden of proof in this case falls to the business that signed the document. They must demonstrate to the satisfaction of the court that the signed agreement is in fact valid, i.e., the identities of the signing parties can be proven, and the document can be shown to have not been tampered with or altered in any way since it was signed.
The QTSP badge is your assurance that a provider offers the highest levels of security, data protection and compliance for the particular services they provide. The EU web site provides a complete list, by member state, of all currently-certified QTSPs, with a detailed listing of the trust services each one offers, both qualified and non-qualified.
